RESILIA Guidance Preview

Cyber Resilience Best Practices AXELOS.com

ix

Preface The resilience of information systems has always been vital to the sustainability of businesses and other organizations. The secure use of information technology has for many years been the topic of guidance and standards describing controls to prevent the loss of critical information. However, the emergence and continuing rapid development of the global networked information environment that we call cyberspace has changed the nature of the problem. While this connectivity offers unparalleled opportunities and benefits, the very same mechanisms create complex and continually evolving risks. This guide offers a practical approach to cyber resilience, reflecting the need to detect and recover from incidents, and not rely on prevention alone. This publication provides organizations with a methodology for implementing cyber resilience. However, detailed and prescriptive instructions on the application of individual cyber resilience controls will depend upon the risks arising from the nature of each business, the environment in which the organization is operating and other factors described in this publication. The risk-based design and implementation of cyber resilience controls can only be delivered successfully through the organization’s management system, which is in turn driven by its strategic goals. This publication uses the ITIL® framework, which provides a proven approach to the provision of services that align with business outcomes. Developed originally for the delivery of effective, business-focused IT services, ITIL is Resilience ience Best Practices now used successfully for the management and provision of other services. Cyber Resil covers a range of cyber resilience practices and activities across the ITIL lifecycle and describes how some of the processes and activities described by ITIL can be used to support an organization’s cyber resilience strategy. This publication is relevant for any organization using technology to manage information that is critical to its success. It is aimed at those who are responsible for staff and processes that contribute to the cyber resilience of the organization, whether designing, operating, supporting or acting as the end users of those information systems.

AXELOS, the AXELOS logo, the AXELOS swirl swirl logo are registered registered trade marks marks of AXELOS Ltd. RESILIA™ is a trade trade mark of AXELOS Ltd Ltd ©AXELOS Ltd 2015

ix

Preface The resilience of information systems has always been vital to the sustainability of businesses and other organizations. The secure use of information technology has for many years been the topic of guidance and standards describing controls to prevent the loss of critical information. However, the emergence and continuing rapid development of the global networked information environment that we call cyberspace has changed the nature of the problem. While this connectivity offers unparalleled opportunities and benefits, the very same mechanisms create complex and continually evolving risks. This guide offers a practical approach to cyber resilience, reflecting the need to detect and recover from incidents, and not rely on prevention alone. This publication provides organizations with a methodology for implementing cyber resilience. However, detailed and prescriptive instructions on the application of individual cyber resilience controls will depend upon the risks arising from the nature of each business, the environment in which the organization is operating and other factors described in this publication. The risk-based design and implementation of cyber resilience controls can only be delivered successfully through the organization’s management system, which is in turn driven by its strategic goals. This publication uses the ITIL® framework, which provides a proven approach to the provision of services that align with business outcomes. Developed originally for the delivery of effective, business-focused IT services, ITIL is Resilience ience Best Practices now used successfully for the management and provision of other services. Cyber Resil covers a range of cyber resilience practices and activities across the ITIL lifecycle and describes how some of the processes and activities described by ITIL can be used to support an organization’s cyber resilience strategy. This publication is relevant for any organization using technology to manage information that is critical to its success. It is aimed at those who are responsible for staff and processes that contribute to the cyber resilience of the organization, whether designing, operating, supporting or acting as the end users of those information systems.


Contents sum summary mary Cyber Resil Resilience ience Best Practices comprises: 

Chapter 1 Introduction Introduces the concept of cyber resilience.



Chapter 2 Risk management Describes an approach to risk management.



Chapter 3 Managing cyber resilience Explains the need for a single management system that will ensure the delivery of cyber resilience alongside other business goals.



Chapter 4 Cyber resilience strategy Addresses the strategy stage of the cyber resilience resilience lifecycle.



Chapter 5 Cyber resilience design Explains the design stage of the cyber resilience lifecycle.



Chapter 6 Cyber resilience transition Concerns the transition stage of the cyber resilience lifecycle.



Chapter 7 Cyber resilience operation Discusses the operation stage of the cyber resilience lifecycle.



Chapter 8 Cyber resilience continual improvement Addresses the continual improvement stage of the cyber resilience lifecycle.



Chapter 9 Cyber resilience roles and responsibilities Describes roles and responsibilities responsibilities necessary to achieve cyber resilience.



Further research Provi Provides des useful references for further research.



Abbreviations Abbreviatio ns and glossary The glossary is a full version of the terms used in this guide.

CASE STUDIES This publication uses three fictitious companies to illustrate how to implement good practice and the consequences of getting it wrong. The three companies are described in section 1.2, and their story will continue in colour-keyed text boxes throughout the publication. Actions and incidents involving the three companies are described in detail in the ‘Scenarios’ sub-sections towards the end of Chapters 4–8.

GLOSSARY TERMS Please note that certain terms are emboldened in the main text. This is to signify their inclusion in the glossary. They are emboldened on first mention only.


xiii

1

Introduction This chapter covers: 

Intended audience



Making cyber resilience real through the use of examples



Aligning cyber resilience with business outcomes



What is cyber resilience?



Important characteristics of cyber resilience



Wider benefits of cyber resilience



How to achieve a sufficient level of cyber resilience

AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

3

1

Introduction The global digital environment, comprising the internet and other forms of digital information technologies, has become the principal nervous system upon which social and economic activity now depends. It has inspired a revolution in the way organization s operate internally and communicate with their customers and suppliers – reinventing business models while increasing the speed and reducing the costs of day-to-day interactions. Individuals, organizations and countries are now dependent on cyberspace for their everyday activities. Yet there is a complex and shifting risk landscape that jeopardizes its operation, its effectiveness and the trust we place in it. Retail companies have been fined heavily for allowing personal data to fall into the wrong hands, and there is now a wider sensitivity about privacy online. Nation states have been accused of stealing intellectual property on an unparalleled scale, particularly from high-tech industries. Many organizations have felt the pain of successful cyber-attacks whether that results in loss of private customer data, release of commercially sensitive information or intellectual property, or the disruption of critical business system s. The impacts can be significant – damage to corporate reputation or loss of competitive advantage. Good cyber resilience provides the necessary measures to address these risks effectively, giving organizations the confidence to exploit the digital age to deliver the opportunities for growth and innovation on which they rely. There will always be a balance between opportunity, cost and risk for the board of any organization to manage. Increasingly these trade-of f decisions rely on having an informed position on cyber resilience across the organization from the board to those responsible for managing IT and all staff who have access to IT.

1.1 INTENDED AUDIENCE This publication is relevant to all organizations that operate in the digital age and use systems to manage information – for example, organizations that: 

Rely on networked information systems for their operations



Handle personal data about their customers and their employees



Possess and employ valuable intellectual property



Use outsourced IT services



Provide IT services, either internally or externally.

The primary audience is those who will actively use and reference this publication for their Foundation and Practitioner course/exams and as part of their day-to-day jobs, so these will include: 

Managers who are responsible for staff and processes where cyber resilience practices are required – for example, those processing payment card information, sensitive commercial data or customer communications



IT service management teams, IT development and security teams, cyber teams and relevant team

leaders – those who operate the information systems that the organization relies on 

IT designers and architects – those responsible for the design of the information systems and the controls that provide resilience



The chief information security officer (CISO), the chief security officer (CSO), IT director, head of IT, IT managers.

The introduction of effective cyber resilience requires a top-down approach with strong support from the board and C-suite executives. One of the benefit s of the way in which this publication has been written is that it can also be read and understood by others in the business. This additional audience will include: 

Executives and managers who are accountable for or responsible for cyber resilience – for example, the board lead on cyber resilience and those designing suitable governance and approving strategy and policy



Other heads of lines of business – for example, risk, procurement, HR, marketing/customer management, the chief information officer (CIO).


4

Cyber Resilience Best Practices



Those responsible for information ownership and management and the policies concerning the use of that information – for example, the director of HR for employee personal data, the director of pro curement for contractors that process sensitive intellectual property and/or the general counsel/head of legal.

1.2 MAKING CYBER RESILIENCE REAL THROUGH THE USE OF EXAMPLES As mentioned in the contents summary, this publication uses three fictitious companies to illustrate how to implement good practice and the consequences of getting it wrong. Their story will be developed in colourkeyed text boxes throughout the publication.

Retail example: SellUGoods The SellUGoods’ risk department is responsible for compliance with the various relevant regulations, working with the business continuity plans where there is synergy and with the IT department to implement technical controls. Within the risk department, the information security manager wants to know more about the need to prepare for incidents and is no longer willing to assume that preventative controls will be successful.

Medical example: MedUServ MedUServ has outsourced all its IT services to a large and reputable provider. The contract is managed by the small finance office that also looks af ter payroll. MedUServ is in the process of negotiating a contract with a new customer, a very large hospital. The contract includes some specific clauses about assuring the cyber resilience of any IT systems where patient data is held. The finance officer has been reading up on the subject.

Manufacturing example: MakeUGoods One of MakeUGoods’ non-executive directors has become concerned about cyber resilience and wants to see whether MakeUGoods is adequately prepared.

1.3 ALIGNING CYBER RESILIENCE WITH BUSINESS OUTCOMES The purpose of cyber resilience is to ensure that an organization can confidently continue to deliver its business strategy and desired outcomes. Cyber resilience measures must therefore be aligned to those outcomes. The cyber resilience lifecycle described in this publication is based on the ITIL service management lifecycle, which offers a proven approach to the provision of services that align with business outcomes. Developed in 1989 and famous for the delivery of effective, business-focused IT services, ITIL is now used successfully for the management and delivery of other services, making the ITIL service lifecycle a natural choice for the delivery of cyber resilience. Cyber Resilience Best Practices covers a range of cyber resilience practices and activities across the ITIL

lifecycle and outlines how the processes and activities described by ITIL can be used to support an organization’s cyber resilience strategy. However, it must be stressed that this guidance is relevant to all organizations, not just those that use ITIL as a basis for their IT service management.


Introduction

1.4 WHAT IS CYBER RESILIENCE?

1.4.1 Evolution from computer security to cyber resilience The rapid growth in the power of the silicon integrated circuit, since its development in the 1960s, has led to today’s modern computer revolution. By connecting computers in what amounts to a single global network, the internet, the impact of the computer revolution has, since the 1990s, been magnified many times f urther. As dependence on information and communications has increased, the scope of security practice has also had to evolve: from computer security to IT security, then to information security and now to cybersecurity and on to cyber resilience. Before networks were significant, computer security was largely based on maintaining a physically and technically enforced boundary around the computer, limiting ordinary user s’ access to resources and privileges to the minimum necessary to allow them to complete their tasks. With the advent of early corporate networked IT, computer security continued to rely on a boundary. It was mainly focused on the hardware, software and networking components, and was largely based on an assumption that good technical controls could deliver the required level of security. With the arrival in the 1980s of personal computing, for the first time the user had a computing device that was not under tight corporate configuration control, and the user became a key part of delivering effective IT security. As users demanded the flexibility and freedom to innovate, they became a significant source of insecurity. Although IT did a good job of managing the security of technology components, it did not provide sufficient coverage of the people and process aspects and often failed to address the security of non-IT business processes. At this point, the topic became known as ‘information security’, reflecting the value of the information rather than the technology itself. Information security was no longer just something the IT department did: it involved the whole business to varying degrees in the protection of their business processes and information. However, for many organizations, there remained a widespread belief that information security was the sole responsibility of the IT department. The expressions ‘cyberspace’ and ‘cybersecurity’ have entered the common lexicon in the past decade, reflecting the impact of the digital age and the recognition that cyberspace has changed the way in which businesses operate. Accordingly, the new term of cyber resilience has also entered the common lexicon. The tendency to leave cybersecurity to the IT department has not, unfortunately, changed for many organizations.

1.4.2 The porous boundary – importance of the external environment The internet has allowed organizations to reinvent their business practices. Supply chains have become more complex and more closely integrated with the business to of fer greater operational ef ficiencies. Organizations trust their supply chains with sensitive information in order to achieve better mutual business understanding, improve efficiency and deliver cost savings. Many organizations have outsourced key parts of their operation to partners, or rely on the professional services of lawyers and auditors, thereby sharing their most precious commercial secrets. Customer engagement with many organizations is largely online, and new organizations exist entirely using this model, for example Amazon. The brand pre sence of an organization may now be dominated by its online presence. Consequently, security is no longer just concerned with protecting processe s, information and data within the perimeter of the business but reaches out across the internet, to the supply chain, to customers, partners and to society as a whole. This does not reduce the need for traditional information security management , but it does change the boundaries and scope of what organizations must do in order to achieve a sufficient level of cyber resilience. ‘Bring your own device’ (BYOD) adds a further twist; consumer products can offer greater functionality and better performance than corporate products.


5

6


What is BYOD? Bring your own device (BYOD) is the expression used for the trend for employees to use personal devices for work purposes. Organizations need to consider the impact of everything they do in this wider context and evaluate how the actions of others might affect their own interests. Commercial organizations need to work together, with governments and with private citizens to achieve cyber resilience.

1.4.3 The internet of things: operating in a hyper-connected world The ‘internet of things’ offers the promise of measuring and controlling many aspects of people’s lives: cyberspace is now moving from being purely an information space to controlling the very environment in which people live.

Key definition The ‘internet of things’ is a proposed development of the internet in which everyday objects have network connectivity, allowing them to send and receive data. Oxford English Dictionary

More and more products now have embedded IT or communications that make them resemble a computing device on a network. Within the office environment, routers and printers are an obvious example, but security cameras, door access mechanisms and heating, ventilation and air conditioning (HVAC) systems are appearing on the network; they are sometimes visible from the internet due to poor network configuration. This makes these devices vulnerable to attack and in turn available to be used in launching attacks on other devices. Outside the office, new generations of cars, TVs and smart meters are being connected to net works.

Bring your own device adds a further twist; consumer products can offer greater functionality and better performance than corporate products


Introduction

The providers of power, water and other critical national infrastructure services represent a more important area of concern as components in the critical national infrastructure, such as water pumping stations and traffic light controllers, are connected to the network and, again, sometimes to the public internet. This is the beginning of the internet of things; it creates a need for cyber resilience in areas of the business that were previously completely unaware of these requirements and contributes to a further increase in the scope of cyber resilience over traditional information security.

1.4.4 Resilience is more than prevention alone Traditional cybersecurity has tended to focus on prevention, albeit with an acknowledgement of the need to monitor operations of people and technology, reflecting the risk appetite and expectation that proper controls will prevent security incidents. However, many will recognize the problem that as the nature of the threat increases, agility and innovation can be hindered by ever more stringent security controls. The threat landscape has developed along with the global internet to the point where the preventative approach is considered inadequate. It is no longer possible to treat IT systems in isolation because they are all connected one way or another to the global digital environment, even if only occasionally, such as when using portable media for routine maintenance, which represents a channel for malicious software.

Key message Recognizing that 100% risk mitigation is not possible in any complex system, the overarching goal of a risk-based approach to cybersecurity is system resilience to survive and quickly recover from attacks and accidents. Partnering for Cyber Resilience World Economic Forum, January 2013

Any connection can provide the route for malicious software, which can currently defeat the best technical and procedural protection, given sufficient commitment on the part of the adversary. For this reason, cyber resilience cannot rely entirely on defensive procedural and technical controls to prevent an incident: organizations must also make the necessary preparations to detect an incident promptly and correct its effects successfully. This philosophy reflects a change that has emerged in the past few years as the network connectivity offered by cyberspace has become more significant. The advantage is often with the attacker and, in addition to investing in proportionate preventative security controls, an organization should devote some resources in anticipation of a successful attack in order to detect the incident and correct quickly. This change also demands more effective risk management and governance – capabilities which will become critical for successful organizations. Resilience is defined by the Oxford English Dictionary as ‘the quality or fact of being able to recover quickly or easily from, or resist being affected by, a misfortune, shock, illness etc.; robustness; adaptability’. In cyberspace, this demands characteristics to prevent an incident and to bounce back after an incident. Security is defined as ‘the state of being free from danger or threat’ and involves the protection of what is important, often with more emphasis on prevention and less emphasis on recovery from an incident. Both terms – security and resilience – are used with varying scope in expert literature. In this publication, resilience is used to encompass prevention, detection and correction.

1.4.5 A definition of cyber resilience Good cyber resilience is a complete, collaborative approach driven by the board but involving everyone in the organization and extending to the supply chain, partners and customers. To balance the cyber risks faced by the business against the oppor tunities and competitive advantages it can gain, effective cyber resilience requires an enterprise-wide risk-based strategy that proactively manages the vulnerabilities, threats, risks and impacts on its critical information and supporting assets. It also involves moving away from strategies that seek solely to prevent attacks on assets to ones that include preparing for, and recovering from, a cyber-attack. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

7

8


Key definition Cyber resilience is the ability to prevent, detect and correct any impact that incidents have on the information required to do business. The critical elements of effective cyber resilience include: 

Clear board-level ownership and responsibility for cyber resilience



The adoption of tailored learning and development for all staff.

This in turn will establish: 

A clear understanding of what the organization’s critical assets are, especially with regard to information



A clear view of the organization’s key threats and vulnerabilities arising from their environment, including that of their customers, partners and supply chain



The adoption of a common language used by all stakeholders in the organization



An assessment of the organization’s cyber resilience maturity and design of appropriate, prioritized and proportionate plans using best-practice guidance



An appropriate balance of controls to prevent, detect and correct.

1.4.6 Using the management system to achieve balance in cyber resilience For effective cyber resilience, an organization must strike the right balance between three t ypes of control activity: preventing, detecting and correcting incidents that jeopardize the cyber resilience of the organization: 

Preventative controls are intended to prevent incidents that jeopardize cyber resilience.



Detective controls are intended to identify the occurrence of an incident that jeopardizes cyber resilience,

so that the organization can respond appropriately. 

Corrective controls are intended to respond to the incident and recover from the situation.

This is illustrated in Figure 1.1. These definitions are expanded in more detail in Chapter 7 of this publication. This type of distinction between controls is reflected in international publications such as the National Institute of Standards and Technology (NIST) Framework for Improving Critical Infrastructure Cybersecurity (more information about this NIST framework can be found in section 8.5.2 of this publication). NIST sets out a sequence of activities comprising ‘identify – protect – detect – respond – recover’, and the need for balance is implicit in their advice.

Prevent

Detect and recover

Controls to stop CYBER RESILIENCE incidents from happening

Controls to detect and recover from incidents when they do happen

Figure 1.1 Achieving a balance of controls Figure 1.1 is ©AXELOS Ltd


Introduction

n

o

C

e a l impr ov

u t i n

m

e

n t

Desig n

O

Strategy

n

p e

o

i

t

r

a t i

o

n

i

a

T r

s

n

Figure 1.2 The ITIL management lifecycle In selecting the appropriate balance between prevention, detection and c orrection, an organization must consider whether cost-effective prevention is viable and whether instead rapid detection and correction can be achieved with an acceptable short-term impact on cyber resilience. In determining the degree of controls to be imposed, an organization must reconcile the often competing demands to deliver the needs of the business, including controlling costs and maintaining user convenience while also mitigating risks to cyber resilience. Different balance points will be appropriate for different systems, assets etc. These decisions must be made as part of a single, coherent risk-based strategy, judged against the risk appetite of the organization. All organizations have management systems, whether formal or informal, to control their activities. The risk-based design and implementation of cyber resilience controls will be achieved only by delivery through the organization’s management system, driven by the organization’s strategic goals. There are a number of different models available for organizations to base their management system on. Cyber Resilience Best Practices will use the management lifecycle of ‘strategy – de sign – transition – operation – continual improvement’, which is defined by ITIL (more information about the ITIL service lifecycle can be found in section 3.2 of this publication). This is illustrated in Figure 1.2. Alternative lifecycles can be used equally well and a foremost example is ‘context – leadership – planning – support – operation – performance evaluation – improvement’, which is defined by ISO/IEC 27001:2013. (More information about ISO/IEC 27001 can be found in section 3.1.2 of this publication.) Chapters 4 to 8 of this guide are structured around a cyber resilience lifecycle based on the stages of the ITIL service lifecycle. Each chapter starts with an explanation of the purpose of that stage of the cyber resilience lifecycle. These are summarized here to provide a context for the rest of the publication: 

Cyber resilience strategy Ensures that all cyber resilience activity is based on clearly understood objectives and helps to achieve the intent of the organization’s governance. The strategy work identifies

critical assets – what information, systems and services matter mos t to the organization and its stakeholders – and it identifies what vulnerabilities and risks they face. 

Cyber resilience design Designs a management system and controls that will meet the intention of the strategy. The design work selects appropriate and proportionate controls, procedures and training to

prevent harm to what matters most, where practical to do so. It also identifies who has what authority to decide and act.

Figure 1.2 is ©AXELOS Ltd


9

10




Cyber resilience transition Moves the output of design into operational use. The transition work will test

the correct operation of the controls and refine how to detect an incident, to know when something is not right with a critical asset, whether through malicious action or accident, and whether this has resulted from internal or external action. 

Cyber resilience operation Operates the controls, and detects and manages cyber resilience event s and

incidents. This includes continual testing of controls to ensure that they are ef fective, efficient and consistent. During operation, the organization must be ready to respond when an incident is detected, to follow a well-rehearsed plan, acting in a timely manner to contain the consequences when something goes wrong and to provide a remedy. 

Cyber resilience continual improvement Ensures that cyber resilience continues to provide the protection

needed in a constantly changing environment. As the organization recovers from an incident, it must learn from its experience, modifying its procedures, its training, its design and even its strategy accordingly. Cyber resilience has to be organization-wide – a complete, collaborative approach driven by the board but including everyone, extending to partners, supply chain and customers. For large and complex organizations with many internal interdependencies, this will represent a considerable challenge. For organizations comprising different companies with distinct environments or cultures, separate initiatives may represent a more practical approach.

1.5 SOME IMPORTANT CHARACTERISTICS OF CYBER RESILIENCE The world has changed. We all now live and work in the digital age, and cyberspace provides its global fabric. Distance and quantity are no longer barriers to the sharing of information. The rapid growth of computing power and connectivity make what was impossible a decade ago now commonplace, but as organizations become ever more reliant on cyberspace, they need it to be resilient. Information is increasingly a valuable and sensitive commodity. Individuals are demanding greater controls over their individual privacy because cyberspace makes it much more easily invaded. An organization that is instrumental in the invasion of someone’s privacy, even by accident, will suffer increasingly severe financial and reputational consequences. Similarly, organizations are finding that cyberspace makes the theft of their vital intellectual property considerably easier. Organizations that lose their trade secrets will jeopardize their commercial position. Some will go out of business as a result.

1.5.1 No absolutes and no certainties – balancing risks and opportunities There is no specific point at which absolute cyber resilience is achieved, and there is generally a law of diminishing returns in the extra resilience arising from additional investment balanced against the exposure to risk that remains. An informed choice about the right level of investment to achieve sufficient cyber resilience requires a good grasp of what and where your critical assets are, the relevant vulnerabilities and risks faced by the organization, and the use of effective risk management techniques. This cost benefit analysis can be hindered by the intrinsic difficulty of expressing thes e risks in financial terms. It is unfortunately the nature of business that security and other re silience controls can add cost and inconvenience to users. Increased cyber resilience may reduce the efficiency and effectiveness of staff, how quickly and easily tasks can be performed and how long it takes for decisions to be made. Furthermore, if an organization seeks to achieve sufficient cyber resilience by placing burdensome controls on its users without explanation of their purpose and importance, it may find those rules circumvented and widely discredited. For example, if staff find their organization’s security measures too difficult to access, they will use their own devices to navigate around them. The solution is a combination of risk management and the intelligent application of controls. Organizations also require a balance between protection of their assets and the ability to respond to innovative ideas. Each organization has to understand this balance according to its particular business needs, considering for example:


Introduction 

Increased sharing of data can result in new business opportunities and increased efficiency, but can also lead to increased data protection risks.



Modern technology may enable new business processes, but it will also introduce new vulnerabilities and the need for new security controls.



Encouraging staff to be creative and imaginative in how they do their work may be vital to revenue and growth but may also demand mitigating controls to manage increased security risks.



Outsourcing and offshoring may result in significant cost reduction for the business, but the risks must be

properly understood and some of the cost s avings re-invested in order to reduce the consequent security risks.

SellUGoods and BYOD When most information resources were located in their offices, SellUGoods could invest in strong perimeter controls to protect the organization. Many people now work outside traditional offices, and computers are as likely to be carried around as to be hosted in dedicated data centres. The increase in the use of cloud services and personal phones and laptops to access business data – BYOD – has led to a reduction in the effectiveness of traditional security controls such as locked doors, security guards and network firewalls, and increased the need for more distributed controls, implemented for example on personal phones and laptops.

MakeUGoods and industrial control systems Even highly secure computing equipment with no connection to other networks and rigid access controls can be subject to security breaches. Industrial control systems (ICS) responsible for sensitive factory automation have been compromised by a sophisticated attack that propagated across the internet to infect systems from which ICS updates were loaded onto USB s torage devices. Traditional technology controls were not able to protect the organization from this sophisticated attack. People and process controls play a vital role in the implementation of cyber resilience.

Domestic devices can be connected to the user’s network making it vulnerable to attack


11

12


Every organization is unique in determining the optimum balance, though the approach is always the same: understand the risk appetite, establish policy and principles, and then implement and manage appropriate security controls. The details of how controls will be applied to an organization will be quite specific to that organization; there is no single set of controls that is appropriate for every organization in every situation. Risk management will be addressed in detail in Chapter 2.

1.5.2 Common cyber resilience threat sources and their methods There are many different sources of threat to an organization that can be mitigated by effective cyber resilience (see HMG IA Standards No.1 and No.2, now known as IS 1&2). They can be categorized in many ways, including: 

Cyber crime Serious and organized crime, generally motivated by financial reward either directly (stealing

money) or indirectly (acquiring the means to steal money). Employees and competitors may also commit these crimes. 

Cyber ‘hacktivism’ Hackers and activists generally motivated by a cause or a belief to achieve a range of

outcomes: for example, to cause harm for revenge. 

Cyber espionage Nation states, generally motivated to gain strategic and economic advantage in trade,

diplomacy or through warfare. 

Business continuity management Natural hazards, including the consequences of the acts of nature, accidental consequences of human action such as operator errors.

Increasingly, these different threat sources exchange techniques and tradecraft or build on one another’s actions to enact more damaging, sophisticated attacks. In one example a large number of usernames and passwords for a UK supermarket were used to p erpetrate a fraud. These had been discovered simply by trying usernames and passwords that had been obtained from security breaches at other organizations. In this case, the combination of weak protection of usernames and passwords combined with the reuse of passwords by users helped criminals to compromise the more secure systems of the supermarket. This illustrates how incidents can comprise a sequence of activities known by some as a ‘kill-chain’. Also, any attacker can cause unintended consequences and collateral damage through their acts, such as thieves who steal cable and disrupt the rail network, causing massively disproportionate unintended economic harm to the wider economy. Within the cyber environment, there are many techniques that can be used by attackers. These too can be categorized in different ways, including: 

Malicious software Known by many names, such as viruses, worms, trojans and rootkits, having subtle distinctions of method but with a common goal of causing the device (phone, tablet, PC, server, network

device, printer etc.) to perform a malicious action that may be covert and persistent. Some are used to collect information such as bank account details or usernames and passwords; some simply cause damage and loss of service; others may demand money to restore encrypted or deleted data; some are used to create botnets. 

Hacked websites A perfectly legitimate but vulnerable website may be modified covertly so that the

browser of an unwitting visitor will execute hidden malicious code, achieving the same outcome as above. Many browsers will warn users that they have asked to visit an infected site, where this is known. 

Botnets These are groups of computers that are performing a common malicious, often covert action. The

name derives from a ‘robot net work’ of computers. Controlled by a remote ‘command and control centre’, botnets are often used in ‘distributed denial of service’ attacks or to send massive volumes of spam email. 

Denial of service attacks These burden and try to overwhelm a legitimate service, such as a website, with

a large number of pointless messages to render it incapable of normal operation. A distributed denial of service (DDoS) attack uses a large number of different machines to mount the attack, usually by means of a botnet.


Introduction 

Socially engineered attacks Phishing is a common form of this type of attack, attempting to trick a user

into trusting a message and then performing an action to the attacker’s benefit. For example, an email claiming to be from a bank might ask for authentication credentials. Fake websites, twitter feeds etc. can also be used. Spear-phishing is a sophisticated form of phishing in which the social engineering is targeted at a specific individual using research, often from social media. 

Network penetration This is the traditional form of attack as por trayed in popular media in which access

is gained across a network to systems, defeating the authentication. This may employ password-guessing, based on lists of stolen passwords, or using knowledge obtained through other means such as simple deception over the telephone, persuading a user to reveal their password.

1.5.3 The insider – usually accidental, sometimes malicious, often damaging A large proportion of techniques for malicious action in cyberspace rely on deception o f a legitimate user at some point: for example, responding to a convincing phishing email. Almost all attacks can be assisted by an insider and some attacks can only be conducted by an insider. Furthermore, most technically based attacks will seek to masquerade as a user at some point and to operate using the user’s authentication credentials within the systems being attacked, in order to avoid detection. Clearly, there is a limit to the protection that purely technical measures can of fer to prevent the legitimate user performing malicious acts, whether unwittingly malicious or intentional. However, measures to detect such acts and alert management should be proportionate and effec tive. For example, if a colleague makes an unusual request for access to contract negotiation information, the organization’s culture should encourage a challenge to that request. Pre-employment screening of employees where possible, an e ffective security culture, training and awareness, continuing personnel security and corresponding arrangements for contractors, partners and suppliers collectively provide controls for reducing the exposure to the insider threat. (For more information on the insider threat, see the Centre for the Protection of National Infrastructure (CPNI) advice pages at www.cpni.gov.uk)

1.5.4 Legal and regulatory requirements There are many different laws and regulations pertinent to the information that an organization handles. Its cyber resilience framework will form a central part of the organization’s compliance measures. These are quite likely to be preventative controls, required to reduce the risk of penalty. Those controls may also overlap with controls an organization needs in order to manage its other business risks. An organization must take professional legal advice to identify all prevailing laws and regulations. These examples serve to illustrate their range: 

Country-specific laws such as HIPAA (the US Health Insurance Portability and Accountability Act) or the European Data Protection Directive (enacted into law slightly differently in each EU country, for example as the UK Data Protection Act).



Extra-territorial regulations. Some laws affect organizations outside the country where the legislation was enacted. For example, the Sarbanes-Oxley Act is a US federal law that affects organizations which have registered securities with the US Securities and Exchange Commission. In practice, this means all organizations that are listed and traded on a stock exchange in the USA, even if they are based in other countries. Although this act is about financial controls, it has significant impact on cyber resilience since it requires controls to ensure the integrity of financial records.



Industry-specific regulations such as the payment card industry regulations (PCI-DSS), which are enforced by the credit card industry to ensure that retailers provide suitable controls to protect credit card data.

1.5.5 Characteristics of confidentiality, integrity and availability (CIA) At the core of information security are the three main characteristics of confidentiality, integrity and availability of information, which confer requirements on information systems and processes. These characteristics apply equally to cyber resilience. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

13

14


Key message The payment card industry data security standard (PCI-DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally. PCI-DSS provides a baseline of technical and operational requirements designed to protect cardholder data. PCI-DSS applies to all entities involved in payment card processing – including merchants, processors, acquirers, issuers and service providers, as well as all other entities that store, process or transmit cardholder data (CHD) and/or sensitive authentication data (SAD). PCI-DSS Requirements and Security Assessment Procedures, Version 3.0, November 2013

1.5.5.1 Confidentiality Confidentiality is the most common characteristic associated with security in the minds of many people: ‘keeping a secret’ or ‘having a private conversation’ are everyday examples of the need for confidentiality. Cyber resilience relies on maintaining the confidentiality of critical information. For example, the loss of confidentiality of commercially sensitive pricing information in merger talks could damage an organization’s ability to secure an agreement.

Key definition Confidentiality is a characteristic of information that ensures it is not made available or disclosed to unauthorized entities. Confidentiality, integrity and availability are the three core characteristics which confer requirements on information security systems and processes.

Any portable media used represents a channel for malicious software


Introduction

1.5.5.2 Integrity The integrity of information is the quality of it being correct: integrity is important for a user to b e able to trust and act on the information. Cyber resilience relies on the integrity of critical information being maintained. For example, loss of integrity of information controlling an industrial process could jeopardize the integrity of the process that uses that information and cause significant harm – even loss of life. The Sarbanes-Oxley Act places demands on the integrity of an organization’s financial data.

Key definition Integrity is a characteristic of information that ensures it is accurate and can only be modified by authorized personnel and activities.

1.5.5.3 Availability Availability means that the information can be used when required: the information system will process the information and the user can trust that it will be there when needed. Cyber resilience relies on availability of information. For example, if the medical results of an urgent test are not available when required, harm or loss of life could result.

Key definition Availability is a characteristic of information that ensures it c an be used when needed by authorized persons.

1.5.6 Authentication, non-repudiation and links to privacy and data protection There have been a number of suggested extensions to the three characteristics described in section 1.5.5: in particular, authentication and non-repudiation.

Key definition Authentication is verification that a characteristic or attribute which appears to be true, or is claimed to be true, is in fact true: for example, that a specific user is who they claim to be.

1.5.6.1 Authentication To take a simple example, authentication concerns establishing a person’s identity, often using a username and password. The password is a secret that should be known only to the parties who use it. There are many issues with the management of traditional passwords, and there are very large numbers of staff who still use passwords as their only means of authentication. There are alternative authentication methods but these can be difficult to implement and manage. Cyber resilience depends on effective authentication. If implemented badly, authentication by demanding knowledge of a user’s identity can convey more information about that user to the other party than is absolutely necessary, which can invade their privacy. Authentication should allow one party to establish the validity of the claim made by the other party: for example, that they have the means to pay for a service or that they are old enough to enter a contract. It should not require access to needless detail, for example about their wider purchasing power and past purchases, their gender or age. As people do more online, companies and governments can build up a picture that might constitute an invasion of privacy.


15

16


Key definition Non-repudiation is providing undeniable proof that an alleged event actually happened or an alleged action was actually carried out, and that this event or action was carried out by a particular entity.

1.5.6.2 Non-repudiation Non-repudiation refers to someone being unable to deny (repudiate) having done something: for example, posting a message or sending an email. Cyber resilience can depend on effective non-repudiation controls: for example, ensuring that a purchaser cannot deny that they made a purchase and thereby defraud an online vendor. Non-repudiation is closely associated with authentication but concerns the persistent data that parties hold concerning transactions. As more and more transactions move to the internet, this becomes increasingly important. Clearly there is a balance between the legitimate need for authentication and non-repudiation on the one hand and the reasonable expectation of privacy and data protection on the other. Many countries have laws or regulations about privacy and data protection, which dictate in particular the rights of individuals regarding the confidentiality of their personal information. To some extent this is simply legal and regulatory enforcement of confidentiality of personal data, but many organizations have stringent data protection requirements which can have as much impact on a cyber resilience programme as the protection of corporate secrets.

1.5.7 The security incident – when things do go wrong It is no longer practical and realistic to put in place suf ficient control measures to guarantee to prevent a breach of information security, though effective preventative controls will reduce the probability. Even a single security incident can have a high cost to financial wellbeing, to reputation and to the careers of an organization’s most senior executives. In extreme cases, it can threaten the survival of the organization. Most organizations will suffer many low-level information security incidents. It is import ant to reduce the impact of a breach by having adequate controls to detect and correct the breach promptly with a scaled response and well-exercised escalation procedures. This prompt response and a focus on apparently low-level breaches can also help to reduce the damage from more advanced persistent malicious activity, which will manifest subtle indicators for vigilant operators and users. The corrective controls and incident management response must be aligned with the business continuity planning activities for information assets and corresponding information services. It is also important to have in place incident management procedures that include senior managers who have been trained and have regular exercises in incident management, including management of the press and protection of the organization’s reputation.

1.6 WIDER BENEFITS OF CYBER RESILIENCE – BUILDING TRUST Good cyber resilience can provide significant benefits beyond mitigation of threats and consequent reduction in exposure to risk. Some customers will ask for certification to the international information security management standard ISO/ IEC 27001 before they will allow an organization to bid for work. Compliance to the PCI-DSS standard is a prerequisite for an organization processing payment cards such as credit cards. However, there is as yet no universal and ubiquitous standard for cyber resilience that can be applied without expert judgement. It is possible to be compliant with the best-designed standard and still suffer a cyber-incident. Equally, an organization will want to look beyond the bald assertion that a partner or supplier is compliant with a particular standard. Good cyber resilience demands, amongst other things, good governance, good risk management, a good understanding of data ownership and effective incident management. Assessment of these characteristics demands experience and judgement. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

Introduction

The benefits of a well-run organization with these characteristics extend beyond mitigating risks arising from cyberspace. Similarly, organizations that develop management systems based on best practice such as ITIL are likely to optimize the value that they create for their customers and increase their competitive advantage through a more effective operation.

1.7 HOW TO ACHIEVE A SUFFICIENT LEVEL OF CYBER RESILIENCE

1.7.1 Information – the life blood of the organization The first step to achieving sufficient resilience in an organization’s use of cyberspace is to understand what information it holds and to identify what needs to b e protected, in priority order. Every organization has valuable information that must remain confidential, whether intellectual property, employee personal data or sensitive commercial agreements. Some organizations will have information whose integrity is important, such as industrial process control instructions. Similarly, the availability of near real-time medical data in an operating theatre is vital. An organization should not seek to protect all information to the same degree, and it will have a different appetite for particular risks to particular categories of information. There may be tensions and trade-offs to be made. This discussion must involve the business, not just the technology teams, and organizations may find it helpful to assign ownership of information assets to those parts of the business for which the information is most vital. For example, the director of HR may be the best placed to identify critical HR information, to decide how it is labelled and handled in a way that achieves the right balance of cyber resilience against cost and user inconvenience.

1.7.2 Business awareness and understanding Over the course of the evolution from computer security to cyber resilience, the community of stakeholders has broadened massively, yet in many organizations the key policy decisions regarding information security activities are still delegated to the IT department. Cyber resilience requires the active participation of the business in the same way that the business manages the balance of other risk-benefit choices. For many organizations, this involvement in a subject hitherto left to the IT department still needs to be explained to the business in a conscious programme of business change, using a compelling narrative. Part of that change includes putting in place the ef fective governance arrangements necessary to achieve sufficient cyber resilience, which will bring the consideration of risk-benefit choices into the mainstream of business decision-making. This requires a top-down approach with strong support from the board. It also requires close alignment with an organization’s risk management process. In a large organization, there may be a group risk function while in a small organization this may be implicit in the general governance activities. Delivery of effective cyber resilience requires attention to all aspects of how an organization’s operation handles its information, including its customers, suppliers and partners. This means agreeing requirements for proportionate cyber resilience preventative controls, detective controls and corrective controls with every supplier, and through them with their own suppliers. Addressing these needs requires the close cooperation of an organization’s procurement function. Rarely should an organization demand precisely the same cyber resilience requirements from all its suppliers, as this will be disproportionate and will increase costs and hidden risks, particularly when dealing with small and medium enterprises. Most organizations are themselves part of someone else’s supply chain and are likely to be obliged to have in place equivalent arrangements. Many organizations will hold client information, some of which can be very sensitive and its loss very damaging: organizations expect their suppliers to look after their information, just as their customers expect them to look after theirs. Addressing these needs may require the close cooperation of an organization’s sales and marketing function. Cyber resilience can also benefit from cooperation bet ween organizations. For example, when financial institutions share information about the activities of attackers, it helps them to mount effective defences. If each bank has to detect and analyse the latest cyber-attack for itself, the attackers will have greatly increased success. Such business-to-business cooperation is often facilitated by government agencies. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

17

18


Stakeholders Cyber resilience should involve many different stakeholders, both internal to the organization and external. As discussed in this section, these stakeholders include: 

Governors and board members who represent the interests of the owners of the organization



Risk management or compliance management departments who must ensure that risks to information are well managed



Everybody within the organization who owns, or uses, information



IT departments or any other parts of the organization that manage information on behalf of others



Customers, clients, or other people or organizations who entrust their information to the organization with an expectation that it will be well managed



Partners or suppliers who process information on behalf of the organization



Competitors and other organizations operating in the same industry who may wish to share information about threats and vulnerabilities



Government and regulatory authorities who expect the organization to conform to legal and regulatory frameworks.

1.7.3 Cyber resilience relies on people, process and technology Cyber resilience relies on the right balance between people, process es and technology as illustrated in Figure 1.3. A common mistake is to become over-reliant on technology and neglect the vital contribution to cyber resilience of well-informed people and well-designed processes. Weaknesses in one area, for example technology, can be mitigated in other areas, for example with stronger process or people controls. The three must be considered so that the components of cyber resilience fit together in a complementary way, without gaps. C yber resilience will also rely on physical security and personnel security measures to ensure completeness.

Technology

People

Figure 1.3 The right balance of people, process and technology Figure 1.3 is ©AXELOS Ltd

Process


Introduction

1.7.3.1 People and cyber resilience The nature of most threats to cyber resilience will involve a legitimate user at some point. An ill-informed user can represent a vulnerability through their unwitting actions. Providing tailored training and improving awareness reduces this likelihood and delivers further cyber resilience through improved user vigilance – being aware of potential incidents and acting promptly to remediate. Cyber resilience should be a consideration for any individual who handles information using technology associated with their organization – that covers just about everybody to some degree. Depending on the nature of the organization, its users may be employees, clients, suppliers or members of the public, over whom it will have varying degrees of influence. Within an organization, the people providing leadership, governance and management have a unique and vital role in improving and maintaining cyber resilience. They will require their own tailored programme of education and awareness-raising.

1.7.3.2 Processes and cyber resilience The processes of an organization include the formal ‘rule book’ and the implicit ‘how we do things here’. Some organizations are run strictly according to detailed rules, while others operate under loose guidance against a set of principles or values. Designing and implementing suitable processes to deliver cyber resilience must take into account the culture of the organization. The nature of the process es must also reflect the organization’s risk appetite and consciously adjust the balance between reducing risks to cyber resilience and reducing efficiency and convenience. Frequently, a risk can be reduced by restricting users’ flexibility and freedom in the manner in which a job is done. There is a tendency for those charged with reducing risks to do just this. Whilst this choice is not always a zero-sum game, the business may frequently have to make a conscious trade-off between on the one hand taking an unpopular action to mitigate a risk and on the other hand accepting the risk. These choices should be made with awareness of their ef fect on the entire business. Cyber resilience will be a consideration for any process that involves handling of information using technology – and that covers just about every activity in most organizations today.

1.7.3.3 Technology and cyber resilience The history of cyber resilience, starting in computer security, means that many organizations will expect the IT department to be entirely responsible for all technology measures to deliver cyber resilience, which is not a sufficient strategy. In a manufacturing plant, it will include the industrial control systems and involve engineers who have previously not been concerned with cyber resilience. It extends to employees’ own devices where BYOD is permitted, and to clients’ and suppliers’ equipment where they share data. For a bank with public-facing systems the end-user devices used by the general public may be poorly maintained with out-of-date sof tware and infected with malicious code. With the proliferation of consumer and industrial devices now connected to the internet, the scope of technology for inclusion in cyber resilience is widening rapidly.

1.8 SCOPE OF THIS PUBLICATION This publication covers all aspects of cyber resilience. It provides organizations with a methodology for its implementation but does not provide detailed and prescriptive instructions on the implementation of individual cyber resilience controls. The choice of specific controls depends on the risks arising from the nature of the particular business, the environment in which the business is operating and other factors described in this first chapter. For proportionate cyber resilience measures, effective risk management is a key foundation.


19

20


1.9 INTRODUCTION QUESTIONS Here are some of the critical questions you should address during the journey to cyber resilience best practice. 1. Who is responsible for cyber resilience in your organization, covering the complete business context with an effective balance of people, process and technology? If that overall role is not assigned, who should it be in your view and how can you communicate the need for action, using language the board will understand and respond to? Who are your allies? Who shares your concern about this topic? 2. In order to prioritize your cyber resilience activities, how well do you know what comprises your organization’s critical information and where it is located? If you do not know, who does? 3. What is the top threat to information and cyber-enabled activities in your organization? How do you keep on top of the latest threat picture for your organization? 4. How well do your board and senior management embrace the concept of risk management for cyber resilience, accepting that there are no certainties? If there is still a view in your organization that the IT department is responsible for preventing information breaches and consequent loss in business performance, what steps should you take to remedy this? For a bank with public-facing systems, the end-user devices used by the general public may be poorly maintained with out-of-date software and infected with malicious code


2

Risk management This chapter covers: 

Management of Risk



Assets, threats, vulnerabilities and risks



Actions to address risks and opportunities


23

2

Risk management Management of cyber resilience is largely about managing risks: identifying things that might happen, assessing how likely they are to happen and what impact they might have, and deciding what action to take. This action typically includes implementing balanced controls to prevent incidents where possible, detect incidents that couldn’t be prevented and take corrective action to protect the business where needed. People usually think of risks as being possible negative outcomes, due to something bad that may (or may not) happen, but there are also positive risks due to good things that may (or may not) happen. An example of a risk with a negative outcome is that a thief might break into the of fice and steal some valuable equipment. An example of a risk with a positive outcome is that an investment in a new business opportunity may result in the positive outcome intended. This uncertainty results in a need f or attention and formal risk management. Something that is certain to happen or has already happened is not a risk, and risk management is not an appropriate response. Managing risks requires identifying, understanding and controlling exposure to risks which may have an impact on business objectives. Every organization manages its risk, but not always in a way that is visible, repeatable and consistently applied to support decision-making. In the worst case, risk management might be completely informal, based on organizations making poorly judged decisions or acting irrationally without considering the costs and benefits of the actions they are taking. The purpose of formal risk management is to enable better decisionmaking based on a sound understanding of risks and their likely impact on the achievement of objectives. An organization can gain this understanding by ensuring that it makes cost-effective use of a risk framework that provides a well-defined approach for managing risks. Decision-making should include determining any appropriate actions to manage the risks to a level deemed to be acceptable by the organization. Each organization will have a different tolerance for risk, and it is the re sponsibility of the board of directors (or equivalent) to define the risk appetite and the approach to be taken to managing risk. A number of different methodologies, standards and frameworks have been developed for risk management. Some focus more on generic techniques widely applicable to different levels and needs, while others are specifically concerned with risk management relating to important assets of the organization in the pursuit of its objectives. Some of these methodologies are described in Table 2.1. Each organization should determine the approach to risk management that is best suited to its needs and circumstances, and it is possible that the approach adopted will leverage the ideas reflected in more than one of the recognized standards and/or frameworks.

Table 2.1 Risk management methodologies Management of Risk (M_o_R ®) Framework for managing risk at all levels through an organization, to help the organization take informed decisions (see section 2.1 for more information on M_o_R). ISO 31000

International standard defining risk management principles and guidelines. Defines a risk management process at a high level. Unlike many other international standards it is intended to be adopted and adapted and there is no certification to this st andard.

ISO/IEC 27001

International standard for an information security management system. This is not a risk management standard, but it includes many requirements relating to risk management. The risk management approach described in section 2.3 is aligned with the requirements in ISO/IEC 27001.

NIST Framework for Improving Critical Infrastructure Cybersecurity

This US framework describes itself as ‘a risk-based approach to managing cybersecurity risk’. The NIST framework is described in section 8.5.1. The risk management approach described in sec tion 2.3 is similar to the approach described in the NIST framework.

COBIT 5

COBIT 5 is a business framework for governance and management of enterprise IT. Although it is not about risk management, it includes aspects of risk management at many levels of the framework. More information about COBIT 5 can be found in section 3.1.7.


24


Many of these methodologies, standards and frameworks cover a much broader scope than just risk management, and more detail about these is provided elsewhere in this publication. M_o_R is solely concerned with management of risk, and is further described in section 2.1.

2.1 MANAGEMENT OF RISK Management of Risk (M_o_R) is intended to help organizations put in place an effective framework for risk management. This will help them make informed decisions about the risks that affect their strategic, programme, project and operational objectives. M_o_R provides a route map of risk management, bringing together principles, an approach and a process with a set of interrelated steps and pointers to more detailed sources of advice on risk management techniques and specialisms. It also provides advice on how the principles, approach and process should be embedded, reviewed and applied differently depending on the nature of the objectives at risk. The M_o_R framework is based on four core concepts: 

M_o_R principles Principles are essential for the development and maintenance of good risk management

practice. They are informed by corporate governance principles and the international standard for risk management, ISO 31000: 2009. They are high-level and universally applicable statements that provide guidance to organizations as they design an appropriate approach to risk management as part of their internal controls. 

M_o_R approach Principles need to be adapted and adopted to suit each individual organization. An

organization’s approach to the principles should be agreed and defined within a risk management policy, process guide and strategies. 

M_o_R process The process is divided into four main steps: identify, assess, plan and implement.

Each step describes the inputs, outputs, tasks and techniques involved to ensure that the overall process is effective. 

Embedding and reviewing M_o_R Having put in place an approach and process that satisfy the

principles, an organization should ensure that these are consistently applied across the organization and that their application undergoes continual improvement in order for them to be effective. There are several common techniques which support risk management, including a summary risk profile. A summary risk profile is a graphical representation of information normally found in an existing risk register, and helps to increase the visibility of risks. For more information on summary risk profiles and other M_o_R techniques, see Management of Risk: Guidance for Practitioners (OGC, 2010).

2.2 ASSETS, THREATS, VULNERABILITIES AND RISKS In the world of cyber resilience, we use the terms assets, threats, vulnerabilities and risks with very specific meanings. It is important to understand these terms when managing risks.

2.2.1 Assets Assets are things that have value to an organization. An organization must determine if (and how) to protect them. Assets might be IT systems, people, information, business processes, intellectual property or anything else which has a value. An asset can be a physical thing like a building, or it can be an intangible thing such as a company’s reputation. If it has a value to the organization then it is an asset that should be suitably protected. Examples of assets that might need to be protected include: 

A tablet computer on the kitchen table



Credit card data stored on a PC



Confidential patient information stored on a server in a hospital



A bank debit card that allows cash to be withdrawn from a bank account.


Risk management

The value of an asset is not fixed: it depends on how the organization uses the asset. For example, a computer that is used by passengers to browse the internet in an airport may have a much lower value to the business than an identical computer that performs a vital function in the air traffic c ontrol centre. Note that the value of the asset that we are discussing here is not the same as the financial value that might be recorded in a fixed asset register. The value here refers to the ability of the asset to produce an outcome for the business.

2.2.2 Threats The formal definition of a threat introduces the concept of a vulnerability, which we will discuss in the next section. Informally, a threat is a circumstance or event that might have an impact on an asset. This impact could vary from complete destruction of the asset, to the ability to obtain a copy of the asset, or the ability to modify the asset (see Figure 2.1). Threats to an information asset are usually considered in terms of their potential impact on the confidentiality, integrity or availability of the asset (see section 1.5.5 for explanations of confidentiality, integrity and availability). Examples of threats might include: 

A burglar might steal from someone’s home.



A criminal organization might send large numbers of emails containing links that download malware when they are clicked.



Someone might buy a server that is no longer needed from an organization and discover confidential data on the disk drive.



A thief might watch someone using an ATM, hoping to steal from them.

Threats exploit vulnerabilities to have an impact on assets.

A tablet or PC is an example of an asset

A tablet or PC is an example of an asset


25

26


2.2.3 Vulnerabilities A vulnerability is a flaw or weakness in security protection that can be exploited by a threat, allowing an attack to succeed. By managing vulnerabilities people are able to reduce the likelihood or impact of threats.

Retail example: SellUGoods Vulnerabilities that could be exploited by criminals attempting to steal payment card data from the customer-facing website at SellUGoods include: 

Vulnerable software due to patches for the website not being kept up to date



Insufficient security training for staff who create website code



Weak website software due to lack of code reviews to detect weaknesses in website code.

The following examples of vulnerabilities correspond to the sample threats above: 

Leaving the kitchen window open provides a thief with easy access to burgle your home



Out-of-date anti-virus software allows downloaded malware to successfully take over a PC



Lack of encryption allows someone with physical access to a disk drive to access all of the information on that drive



Lack of awareness of the risk of shoulder surfing results in a debit card PIN being entered without attempting to hide the keys being pressed, so the person standing behind can see the PIN.

Key message There is not a simple relationship of one threat and one vulnerability for each asset. Each asset could be compromised by many different threats, and each of these threats could exploit a range of different vulnerabilities.

2.2.4 Risks A risk is a possible event that could cause harm or loss, or affect the ability to achieve objectives. A risk is measured by the probability of a threat, the vulnerability of the asset to that threat, and the impact it would have if it occurred. Risk management considers the value of the asset, the impact on the asset if the threat succeeds, and the likelihood of the threat succeeding based on understanding the vulnerabilities it could exploit. The examples of risks shown in Table 2.2 are based on the threats and vulnerabilities described above.

Threat

Vulnerability

Figure 2.1 A risk is created by a threat exploiting a vulnerability to impact an asset Figure 2.1 is ©AXELOS Ltd

Asset


Risk management

Table 2.2 Examples of assets, threats, vulnerabilities and associated risks Asset

Threats

Vulnerabilities

Risks

A tablet computer on the kitchen table

A burglar might steal the tablet

The kitchen window is open

The burglar might climb through the kitchen window and steal the tablet

Credit card data stored on a PC

An email arrives with a link that could download malware

The anti-virus software is out of date

The user may click the link and credit card data may then be transferred to a criminal organization The organization’s reputation may suffer

Confidential patient information stored on a server in a hospital

A bank debit card that allows cash to be withdrawn from a bank account

Someone might buy a server that is no longer needed from our organization and discover confidential data on the disk drive

A thief might watch someone using an ATM, hoping to steal from them

Users have not been trained to never click links on unsolicited emails

The financial regulator may impose a fine

An employee is unaware of the IT policy that states that all data on disk drives must be erased before that equipment is released from use

Newspapers may report that the hospital has not protected patient data properly, and the hospital’s reputation may be severely impacted

Confidential patient information is not encrypted

Patients may sue the hospital for breach of their privacy

The bank debit card user is not aware of the risk of shoulder surfing and enters their PIN without sufficient care

If the thief withdraws money from the bank account, the bank may say it is the bank account holder’s responsibility since their PIN was used and they may lose the money

2.3 ACTIONS TO ADDRESS RISKS AND OPPORTUNITIES It is essential to identify and manage risks. This does not mean that an organization has to invest in controls to manage every risk, but it does have to understand the risks being faced, make a decision about how to treat each risk, document the risk treatment plan, and verify that the plan is being followed. Every organization has a limited budget for investing in cyber resilience, and an organization that does not use a formal risk management process is likely to protect against the wrong risks and waste money and resources. Failure to protect against actual risks may have a major impact on an organization’s continuing existence. Every year thousands of organizations suffer security breaches, and many businesses do not survive as a result of the losses incurred. The National Cyber Security Alliance estimates that ‘60% of small businesses will close within six months of a cyber attack’. Investing in the right security controls can significantly reduce the risk of a security breach happening. There are many different approaches to managing risk. Some focus on assets, threats and vulnerabilities, others on more general business risk, or on scenarios that could lead to business impact. Des criptions of some of these approaches can be found in Table 2.1. Every organization should adopt an approach to risk management that is appropriate for its circumstances. Selection of a risk management approach is often a governance decision, and the selected approach may be mandated for use throughout the organization. The following methodology describes an approach to risk management based on understanding assets, threats and vulnerabilities. This methodology is similar to the approaches described in ISO/IEC 27001:2013 and in the NIST Framework for Improving Critical Infrastructure Cybersecurity. The approach described below


27

28


is a good methodology for understanding security risks, but if an organization is already making effective use of a different risk management methodology then it might be appropriate to use or adapt this to manage its cyber resilience risks. Whatever approach is used, it should cover all of the activities described here. There are a number of distinct phases required to address risks, as shown in Figure 2.2 and described below. Figure 2.2 illustrates the activities that are required, the order in which they should be carried out, and the main feedback loops.

2.3.1 Establish context There are some actions that need to be taken before starting to assess and manage risks. These include: 

Understanding the organization and its context, including any internal or external issues that are already known to be relevant to cyber resilience. This could include asking questions like ‘why are we st arting a cyber resilience project?’ or ‘what are we worried about?’



Understanding the needs and expectations of stakeholders, including legal and regulatory requirements and contractual obligations (see section 1.7.2 for a discussion of stakeholders).



Identifying the scope of the security management system, and understanding how this maps to the overall management system (see section 3.1 for a discussion of management systems).

Establish context

Risk identification

Risk analysis and evaluation

Risk treatment

Risk monitoring and review

Figure 2.2 Actions to address risks Figure 2.2 is ©AXELOS Ltd


Risk management

Many of these actions should be defined and managed as part of the governance of the organization. Chapter 4 looks in more detail at the strategy stage of the service lifecycle, which includes these activities. The context should be re-evaluated on a regular basis to ensure that risk management continues to be aligned with the needs of the organization.

2.3.2 Establish criteria for risk assessment and risk acceptance Every organization should document criteria to ensure that pe ople carrying out risk assessment s use consistent methods. 

Risk assessment criteria Define how risk assessments should be carried out.



Risk acceptance criteria Define which risks should be accepted (and which risks therefore require action

to be taken to reduce the likelihood or impact of the risk). Risk assessment criteria should be defined to ensure that assessment results are consistent, that comparisons between assessments are meaningful, and therefore that assessments can be used for ongoing management of security risks.

Cost of security controls An organization could decide to control access to a building by using turnstiles operated with an ID card and PIN. This would increase security by making it much harder for an intruder to access the building. The cost of the new system would include: 

Financial cost of the new equipment



Costs of the implementation project and team



Costs of staff awareness communication and training



Increased time for staff to arrive at work in the morning due to queues at the turnstiles



Ongoing cost of resetting PINs when users forget them



Ongoing cost of maintaining the turnstiles and card readers.

Using PIN and ID card access to an organization’s office requires the involvement of all staff members


29

30


Risk acceptance criteria should be defined to support the governance goals of the organization and to ensure consistent decisions regarding what risks are considered acceptable. It is not possible for any organization to completely eliminate all risk. Even after extensive controls have been put in place there will always be some residual risk. Security controls also have costs. This is not limited to the cost of implementing the control itself. There is also often the cost of working with the effect of the control – for example it may slow down a business proces s or require more people to be involved in an activity. Each organization needs to consider the level of risk that it is prepared to accept, and to document its risk appetite and risk acceptance criteria in a form that people actually carrying out risk management can use. This will help to ensure consistent decision-making that is aligned with the needs of the organization.

2.3.3 Risk identification Risk identification starts by identifying the assets that need to be protected, and the ownership of those assets. The scope of the management system should help to identify which assets must be considered (see section 3.1 for a discussion of management system scope). It is important to remember that these assets include intangible assets such as business processes and the reputation of the organization, as well as physical assets such as people, IT systems and buildings. Section 6.1 discusses asset management in more detail.

Key message The purpose of cyber resilience risk management is to protect valuable information assets. Start by identifying the assets that need protecting. Risk identification considers what threats might impact these assets, what controls are already in place to protect the assets, and what vulnerabilities still remain. Consideration is given to threats that might impact the confidentiality, integrity or availability of assets. Risk identification should use a wide range of inputs to help ensure that all significant risks have been considered. Subsequent steps will establish the significance of risks, but any risks that are missed at this stage are unlikely to be identified later. It is essential to identify an owner for each asset to ensure that decisions are made based on the business value of the ass et, and that someone is accountable for understanding that value. Inputs which could help with risk identification include: 

Outputs of previous risk assessments



Current or retired risks that have been documented on a risk register



Information about common threats and vulnerabilities provided by vendors, partners or other organizations



Information about risks that have been identified by other parts of the organization



Checklists based on standards such as ISO/IEC 27001, the NIST cybersecurity framework, or best practices such as this publication



Output of technical tools such as firewall logs or report s from intrusion detection tools or intrusion prevention tools



Interviews with customers.

Each identified risk should be assigned a risk owner, who is accountable for ensuring that the risk is understood and appropriate action is taken. The list of risks and risk owners should be documented in a risk register, which should include details of the assets, the threats to those assets, and the vulnerabilities that might lead to the threats successfully compromising the assets. This risk register should be maintained to ensure that up-to-date information about risks is available in a consistent form and that the status of each risk is always understood. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

Risk management

2.3.4 Risk analysis and evaluation Risk analysis and evaluation is required for each identified risk. Risk analysis considers all the available information about the asset, the threat and the vulnerabilities to provide answers to the following questions: 

How likely is the risk to materialize?



What impact would the risk have on the asset?



What impact would the risk to the asset have on the business?

Risk analysis can be quantitative or qualitative. Quantitative risk analysis considers financial and other impacts in strict numerical terms. It also uses numerical estimates of probability to result in projections of the actual cost of a risk. This risk is commonly expressed as an annualized loss expectancy (ALE), and is calculated by multiplying the single loss expectancy (SLE) by the annual rate of occurrence (ARO). ALE is often compared with the cost of mitigating a risk, to provide information that can be used in return on investment (ROI) calculations and to justify investment in suitable controls to modify the risk. Qualitative risk analysis uses a simple scale, such as high, medium, low, to distinguish different levels of likelihood and impact. Qualitative risk analysis often makes use of a table which is used to derive an overall risk level from levels of impact and likelihood.

Example of a loss expectancy calculation for a retail organization: SellUGoods SellUGoods Ltd has heard about incidents where customer data has been breached at other retail organizations, and the information security manager has been analysing the potential cost if this happened at SellUGoods. The calculation for annual loss expectancy is: ALE = SLE * ARO where ALE is the annual loss expectancy, SLE is the single loss expectancy, and ARO is the annual rate of occurrence. In our example: 

The information security manager estimates that the cost of an incident where a large number of payment cards are leaked would be $800 million. This figure includes lost sales, lost share value, the cost of compensating customers and other costs that have been identified in other similar breaches. This is the single loss expectancy, so SLE = $800 million.



The information security manager has researched the frequency of this kind of data breach, and thinks that every year approximately one large retailer in every 2,000 suffers a data breach of this sort. In other words a retailer like SellUGoods can expect to see a data breach once every 2,000 years. This is the annual rate of occurrence, so ARO = 1/2000 = 0.0005.



The annual loss expectancy is the average amount that SellUGoods can expect to lose each year. In this case it is calculated, according to the formula above, as $800 million * 0.0005 which gives a value of $400,000.

This figure of $400,000 represents the upper limit of what SellUGoods should consider spending each year to prevent or mitigate this kind of event.


31

32


High

Impact

Medium

Low

Figure 2.3 Example of a matrix for defining qualitative risk levels

Medium

High

High

Low

Medium

Medium

Low

Low

Low

Low

Medium

High

Likelihood

The output of the risk analysis is a determination of the level of risk, which is documented as part of the risk assessment. In the example in Figure 2.3, something that has a medium likelihood and a high impact would be rated as a high risk. What this means is specific to the organization; something that is high risk in one organization might be medium or low in another. This particular example has a simple high/medium/low scale but some organizations use a five-point scale on e ach axis of the matrix. There is no ‘correct’ matrix – it just needs to be used consistently within the organization. Therefore, the output of qualitative risk assessment cannot usually be compared across organizations. Risk evaluation compares the results of risk analysis with the documented risk acceptance criteria, and then prioritizes risks to ensure that investment is focused on the most important risks. Qualitative risk assessment requires much less time and ef fort than quantitative risk assessment, and often provides sufficient information to enable the organization to decide which risks should be addressed. A combination of qualitative and quantitative approaches may be appropriate for some organizations. This usually involves carrying out an initial qualitative assessment to prioritize risks, followed by a quantitative risk assessment for medium- and high-impact risks, to provide data needed to support the business case for addressing those risks.

Retail example: SellUGoods If criminals obtained copies of payment card data from SellUGoods the impact would be high. If SellUGoods did not implement controls to prevent criminals stealing payment card data, then the likelihood of this would be high and therefore the risk would be high. Even after implementing controls the residual likelihood might be medium, so the risk would still be high. This is likely to be an unacceptable residual risk, so more controls would be needed.

2.3.5 Risk treatment There are many different things that an organization can choose to do about a risk. It is not always necessary to reduce or eliminate risks: a judgement on what to do will depend on the nature of the risk, the cost of any action required to mitigate the risk, the likelihood and impact of the risk, and the organization’s risk acceptance criteria. Actions that can be taken to handle a risk include risk avoidance, risk modification, risk sharing and risk retention, as described in Table 2.3. Figure 2.3 is ©AXELOS Ltd


Risk management

Table 2.3 Methods of treating risk Risk avoidance

Prevent the risk by not carrying out the business activity

Risk modification

Implement controls to reduce the likelihood or impact of the risk

Risk sharing

Reduce the impact by passing some of the risk to a third party

Risk retention

Intentionally decide to accept the risk because it is below an acceptable threshold

These are described in more detail in sections 2.3.5.1 to 2.3.5.4 The decision about how to treat each risk should be agreed with the risk owner, and documented in a risk treatment plan. There must be appropriate communication about how each risk will be treated. Decisions about who needs to know about each risk should be based on the likelihood and impact of the risk and defined as part of the agreed criteria for risk assessment (see section 2.3.2). Some major risks may need to be discussed at board level, whereas many smaller risks only need to be understood by the assigned risk owner. The overall risk treatment plan should also be communicated, reviewed and approved by someone with appropriate authority.

2.3.5.1 Risk avoidance Risk avoidance can be achieved by not carrying out the activity that could lead to the risk. For example: 

The risk of data being compromised by a third party could be avoided by never allowing other organizations to have access to sensitive data. This may be difficult and expensive, but in some circumstances it may be appropriate in order to avoid a risk.



The risk of an investment in a new business opportunity not delivering the required ROI can be avoided by deciding not to invest in the business oppor tunity. This type of risk avoidance is actually very common when business investments are seen to have significant risk; it is often better to invest in a different opportunity that has lower risk of failure.

Retail example: SellUGoods SellUGoods may choose to avoid the risk of a third part y exposing their payment card data, by only allowing their own staff to have access to this data. Alternatively they could make use of third parties to do some processing of payment card data, but they would then need additional controls to mitigate this risk. Risk avoidance can certainly be very effective in removing risks, but it can also result in the organization failing to capitalize on opportunities. Risk avoidance is a common response for managing positive risks such as entering a new market or seizing a new business opportunity, but this can result in significant long-term negative risk if competitors take advantage of these opportunities. This means that organizations must consider alternatives to risk avoidance if they want to be successful. The purpose of cyber resilience risk management is to balance the risk against the costs and oppor tunities. It is not possible to eliminate all risk, so some residual risk will have to be accepted; this is why the organization should establish a risk appetite and risk acceptance criteria. Risk can also be a good thing: an organization that takes no risks is unlikely to be competitive or to succeed in the long term.

2.3.5.2 Risk modification Risk modification involves implementing controls that will change the likelihood or impact of a risk. For a negative risk this will usually be to reduce the threat’s likelihood or impact – but remember that risk management also applies to positive risks as well as negative ones, so risk modification could make a positive risk more likely. Controls that reduce the likelihood of a risk are often thought of as cybersecurity controls, whereas controls that reduce the impact of a risk may be seen as cyber resilience measures. AXELOS, the AXELOS logo, the AXELOS swirl logo are registered trade marks of AXELOS Ltd. RESILIA™ is a trade mark of AXELOS Ltd ©AXELOS Ltd 2015

33

34


Key definition Defence-in-depth uses multiple independent security controls to provide redundancy.

If one control fails, or a vulnerability is exploited, then assets will be protected by alternative controls. It is common for a threat to require more than one vulnerability before it can successfully compromise an asset. This is why many cyber resilience designs are based on the idea of defence-in-depth, so that if a threat is able to exploit one vulnerability there will be further security controls that can still prevent the risk from occurring, or reduce the impact of the risk if it does occur. Examples of controls include: 

Encrypting all confidential data This reduces the vulnerability of the data to many risks such as theft or

accidental disclosure. 

Acceptable use policies and awareness training These can be used in many areas, for example to reduce

the likelihood of staff following links that would install malware onto PCs. Risk modification is the most common response to security risks, and many examples of controls that are intended to reduce the likelihood or impact of threats are described throughout this publication.

Retail example: SellUGoods Some things that SellUGoods could do to mo dify the risk of criminals stealing payment card data are: 

Ensuring that they comply with the payment card industry data security standard (PCI-DSS)



Training software development staff in how to prevent SQL injection and buffer overflow attacks



Carrying out code reviews of all website code



Ensuring that patches for the customer-facing website are installed very soon after they are released



Only storing the absolute minimum amount of data and deleting this as soon as it is no longer needed.

2.3.5.3 Risk sharing Risk sharing may be achieved by insuring against the loss that the risk would cause, or by contractually passing responsibility for the risk to another organization. ‘Risk sharing’ is sometimes known as ‘risk transfer’, but ‘risk sharing’ is a better term as the risk cannot normally be completely passed to a third party. For example, if an organization has fire insurance, this will provide financial compensation when there is a fire, but the fire may still have an enormous impact on the organization. Many services are designed to transfer risks between organizations. For example, if an organization purchases IT infrastructure as a service (IaaS) from another organization, then many of the risks involved in operating that IT infrastructure are also transferred. The organization purchasing the IaaS is charged for the service and effectively pays the other organization to share the operational risks. Accountability for a risk can never be transferred to a third party: even if the third party has agreed to accept the risk, the outsourcing organization is still accountable for it. This means that the outsourcing organization has to ensure that the third party is managing the risk effec tively, and that the contract covers every eventuality. Service providers often word contracts in a way that avoids responsibility for things that the outsourcing organization might think are covered.


Risk management

2.3.5.4 Risk retention Risk retention is a deliberate decision to accept a risk without taking any measures to avoid, modify or share it. This may be appropriate for risks that have a very low impact, or a very low probability. The decision to retain a risk should always be based on previously agreed criteria for risk acceptance (see section 2.3.2) and must be clearly documented and communicated to appropriate stakeholders. Retained risks should be do cumented in a risk register, so that they can be monitored in case the probability or potential impact changes. When risks have been avoided, modified or shared, it is likely that there will still be some level of residual risk. This residual risk must be compared with the organization’s risk acceptance criteria and formally retained, to ensure that sufficient controls have been put in place to meet the organization’s governance requirements.

2.3.6 Risk monitoring and review It is not sufficient to just carry out an assessment, document risk treatments and pass these to people to implement. There must be a process in place to monitor and review risks to ensure that: 

Risk treatments documented in the risk treatment plan are carried out as defined.



The actual effect of implementing risk treatments is understood, compared with the effect predicted by the risk treatment plan, and any deficiencies are identified and acted on.



New threats are identified and result in updated risk assessments.



Residual risks are transferred to a risk register which provides a consolidated view of risks.



New vulnerabilities are identified and result in updated risk assessments, and new entries in the risk register.



Changes in the likelihood or impact of specific threats are identified and result in updated risk assessments.



New, changed or removed assets are identified and added to (or removed from) the risk treatment plan as appropriate.



Changes in the business environment are understood and result in modified risk assessment criteria or risk acceptance criteria where appropriate.

Risk monitoring and review are discussed in more detail in Chapters 7 and 8, as they make a significant contribution to operation and continual improvement. Many risks will be managed by controls (a risk modification measure), and these controls should be constantly monitored to ensure they are effective, ef ficient and consistent. There are many different types of control, such as policies, procedures, standards, training and technical controls, and the effectiveness, efficiency and consistency of these controls needs to be verified. In this context: 

Effectiveness is the ability of the control to achieve its purpose.



Efficiency is a measure of the amount of resource required.



Consistency is a measure of how completely the control has been applied to all appropriate assets. For example, a required security patch may have been installed on 99% of vulnerable servers, but a threat to the remaining 1% of vulnerable servers may have a major impact.

When security breaches are reported it is very common to discover that controls which should have been in place would have prevented the breach, but lack of verification meant that the organization did not discover that the controls were not consistent until after the breach. This is why it is essential to carry out regular reviews and audits of all cyber resilience measures.


35

RESILIA Guidance Preview

Recommend Documents